Massive Data Breach Hits French Immigration System: A Cyberattack That Exposed Sensitive Personal Information

What Happened: A Breach Through a Partner

The breach did not occur directly on OFII’s core systems. Instead, it stemmed from a cyberattack on a private company contracted by OFII to manage the Contrat d'intégration républicaine (CIR), a statutory integration program for immigrants that includes language and civics education.

According to the OFII’s director-general, Didier Leschi, the intrusion originated through this subcontractor’s systems, which had authorized access to a database containing the personal details of immigrants participating in the program.

Officials stressed that the agency’s own internal systems were not directly breached, but attackers were able to harvest sensitive data due to the subcontractor’s access privileges.

What Data Was Exposed?

Cybercriminals published sample files online on January 1, 2026, claiming to possess a much larger dataset. While the exact scale of the breach is still under review, verified samples contain highly sensitive information, including:

• Names and surnames of foreign residents
• Dates of entry into France
• Reasons, types, and purposes of stay (such as employment, family reunification, or refugee status)
• Email addresses and phone numbers
• Nationality and residency program details

The published samples included fewer than 1,000 individuals from countries like Ukraine, Cameroon, Afghanistan, China, and Israel, but the threat actor claims to hold data on up to 2 million people. That latter claim has not been independently verified.

Why This Breach Matters

1. Extremely Sensitive Personal Data

Unlike breaches involving only email addresses or non-identifying metadata, this incident exposed immigrant records tied directly to legal status and duration in France, which could be exploited in fraud or identity theft.

2. Vulnerable Populations Affected

Many of the individuals whose data were compromised are among the most vulnerable groups, including refugees and people navigating immigration processes. The exposure of their personal details carries heightened emotional and legal risk, including the potential for targeted scams or deception tied to immigration services.

3. Third-Party Risk Is Real

This breach underscores a growing cybersecurity truth: your data is only as safe as the weakest link in your digital chain. Even if OFII’s main systems remain secure, the contractor’s security lapses enabled significant data exfiltration.

This has broader implications for every organization that shares data with external partners or service providers, especially when such partners handle highly sensitive personal information.

Official Responses & Next Steps

OFII has confirmed the breach and stated it will file a formal complaint and sanction the subcontractor involved.

Director-General Didier Leschi emphasized that the breach was not rooted in OFII systems but occurred through an external operator.

Investigations are underway to clarify how the unauthorized access was gained, whether through hacking or internal compromise.

France has also faced recent cyber incidents affecting government systems, heightening pressure on authorities to improve digital security across public administration.

What Affected Individuals Should Do

• Monitor Communications: Watch for unsolicited emails or messages claiming to be from government services, immigration officials, or residency support organizations.
• Guard Against Scams: Never provide additional personal information in response to unexpected requests, especially if they reference your immigration status.
• Report Suspicious Activity: Notify local authorities or the French data protection regulator (Commission Nationale de l’Informatique et des Libertés —CNIL) if you suspect misuse of your information.

Conclusion: A Wake-Up Call for Public Sector Cybersecurity

The OFII subcontractor breach is a stark reminder that data protection extends beyond internal IT systems: it must encompass every partner and vendor gatekeeper that has access to sensitive information. As more public services digitize, the intersection of administrative convenience and cybersecurity risk becomes sharper, especially for populations whose safety and rights depend on the confidentiality of their records.

This breach is still unfolding, and investigations will likely reveal more about the scale and impact in the coming weeks. For now, it stands as a case study in how third-party exposure can ripple across an entire data ecosystem, with real consequences for individuals and governments alike.